The vulnerability is an insufficient input validation flaw in the LAN Setup feature of NETGEAR R7300 routers that allows an authenticated administrator connected to the local network to perform actions that they should not have permission to execute. If successfully exploited, an attacker with admin credentials could alter router configuration, potentially exposing the network or enabling further attacks. The issue was identified in a simulated environment and has not yet been confirmed on physical production units, so the real-world impact is uncertain, but the potential for unauthorized changes remains.

This flaw affects NETGEAR R7300 routers that are End‑of‑Support, specifically the R7300DST and Nighthawk AC1900 DST models. No firmware versions are listed as safe, and models marked (EoS) will not receive a security update, so any device with those models remains vulnerable.

The CVSS score is 4.3, indicating moderate severity, while the EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting a lower likelihood of widespread exploitation. The attack requires local, authenticated access to the router, meaning an attacker must first compromise or have legitimate administrator credentials; once in, they can use the flaw to execute unauthorized administrative actions. Although the exploit is not remotely triggered, the need for local access reduces risk compared to publicly exploitable vulnerabilities but still warrants prompt patching or device retirement.